{ "product": "HefestoAI", "changelog": [ { "version": "4.20.4", "date": "2026-10-27", "type": "fix", "highlights": [ "Known public client keys (PostHog phc_ project tokens, Stripe pk_live_/pk_test_ publishable keys) are reported as LOW HARDCODED_SECRET instead of CRITICAL. PostHog phx_/phs_ and Stripe sk_/rk_ keys stay CRITICAL, as does a public key assigned to a secret or password variable", "Findings no longer depend on the Python warning filters of the run, and analyzing code with an invalid escape sequence such as \"\\d\" no longer prints Python warnings to stderr", "hefesto pr-review reports complexity, long-function and deep-nesting findings when only a function's body changed, and adds anchor_line for inline comments. A critical_tests section in .hefesto.yaml is validated (preview; nothing enforces it yet). No CLI flag or exit-code change" ] }, { "version": "4.20.3", "date": "2026-10-20", "type": "feat", "highlights": [ "hefesto analyze can skip its pypi.org newer-version check: set HEFESTO_NO_UPDATE_CHECK=1 (or true, yes, on), HEFESTO_TELEMETRY=0 or DO_NOT_TRACK=1. Usage events stay on by default, and hefesto telemetry disable does not skip the check. The GitHub Action's default telemetry: 0 skips it on runners", "SARIF output tags Python security findings with CWE ids (external/cwe/cwe-N) and adds a CWE taxonomy: HARDCODED_SECRET 798, SQL_INJECTION_RISK 89, COMMAND_INJECTION 78, EVAL_USAGE 95, BARE_EXCEPT 396, PICKLE_USAGE 502. An issue's own metadata.cwe still wins", "The repository has a root .mcp.json for HefestoAI's hosted MCP server and the README an Add to Cursor button; a manual MCP Registry workflow (dry run by default) was added. No CLI flag or exit-code change" ] }, { "version": "4.20.2", "date": "2026-10-17", "type": "fix", "highlights": [ "YAML files are parsed once instead of two or three times, with yaml.CSafeLoader when libyaml is installed (otherwise yaml.SafeLoader). On a 1 MB multi-document Kubernetes manifest the analyze run went from 4.5 s on 4.20.1 to 0.7 s on the maintainer's benchmark machine", "Fail-closed behaviour from 4.20.1 is unchanged: a yaml.YAMLError is a YAML_SYNTAX_ERROR finding and fails --fail-on. Documents nested deeper than 256 levels and a few constructs libyaml handles differently are parsed with yaml.SafeLoader", "PyPI and TestPyPI releases publish with Trusted Publishing (OIDC) and PEP 740 attestations. No CLI flag or output format change. Exit codes match 4.20.1 except for YAML nested about 483-488 levels deep, which now gets the HIGH YAML_SYNTAX_ERROR finding" ] }, { "version": "4.20.1", "date": "2026-10-17", "type": "fix", "highlights": [ "Exit code change: under --fail-on, a found file that could not be analyzed now fails the gate (exit 1) instead of being dropped without a warning. Pass --allow-not-analyzed (GitHub Action: allow_not_analyzed: 'true') to keep the 4.20.0 exit code; the file is still listed and warned about", "A JSON file the parser cannot load (for example an array nested 5000 levels deep) still gets its J001 hardcoded-secret findings through a regex fallback", "A found file that is not valid UTF-8 is now analyzed with a latin-1 fallback and listed as decoded with fallback, so its findings count. Without --fail-on the exit code is unchanged" ] }, { "version": "4.20.0", "date": "2026-10-16", "type": "feat", "highlights": [ "hefesto analyze now runs nine more analyzers: PowerShell, JSON, TOML, Makefile, Groovy/Jenkins, CloudFormation, ARM, Helm, and Serverless. Files that 4.19.0 skipped are analyzed, so new findings can appear and a --fail-on gate that passed on 4.19.0 can fail. The GitHub Action runs the same engine", "JSON and YAML files are classified from their contents as CloudFormation, ARM, Serverless, or Helm values. *.tf.json stays Terraform; Chart.yaml and templates/ stay YAML", "Directory walks skip generated lockfiles (package-lock.json, composer.lock, poetry.lock, Cargo.lock, and others). Naming one on the command line still analyzes it. No CLI flag, output format, or exit-code change" ] }, { "version": "4.19.0", "date": "2026-10-15", "type": "feat", "highlights": [ "The CLI may print one stderr notice after a command: the PRO API server, enrichment, or scope gating ($8/mo), OMEGA IRIS ($19/mo), or an analysis-count milestone. It is not printed in CI, when stdout is not a TTY, with --output json or sarif or --quiet, or when HEFESTO_TELEMETRY=0, DO_NOT_TRACK=1, or HEFESTO_NO_UPSELL=1. At most one notice every 7 days, and each type at most 3 times", "hefesto info prints one line, PRO ($8/mo) adds the API server, enrichment, and scope gating. OMEGA ($19/mo) adds IRIS., and exits 1. In CI, when stdout is not a TTY, or when notices are opted out, it prints nothing", "hefesto init prints Plans: PRO $8/mo ยท OMEGA $19/mo. on stderr only when those notice rules allow it. GitHub Action users: no change" ] }, { "version": "4.18.0", "date": "2026-10-15", "type": "feat", "highlights": [ "hefesto init installs the same git hooks as install-hooks and prints the plans link. After a hook blocks a commit, the CLI prints PRO $8/mo once. That line is not printed when CI=true or when GITHUB_ACTIONS is set", "Anonymous usage events go to PostHog and stay on unless you opt out (hefesto telemetry disable, HEFESTO_TELEMETRY=0, or DO_NOT_TRACK=1). The first eligible run prints a notice and sends nothing. hefesto telemetry status and hefesto telemetry clear are gone", "After analyze, a newer release cached from PyPI still prints Hefesto X available, including when usage events are off. With --output json that line goes to stderr, so stdout stays JSON. GitHub Action users: no change" ] }, { "version": "4.17.1", "date": "2026-10-15", "type": "fix", "highlights": [ "hefesto install-hooks installs hooks in your own project and exits 1 when it writes no hook (for example with core.hooksPath set); run it again if you ran it before 4.17.1. GitHub Action users: no change", "check-test-contradictions no longer flags a no-argument call whose tests set different environments in the test itself (monkeypatch, os.environ, patch, platform skipif, freeze_time)" ] }, { "version": "4.17.0", "date": "2026-10-14", "type": "feat", "highlights": [ "COBOL004 recognizes BINARY-CHAR, BINARY-SHORT, BINARY-LONG, BINARY-LONG-LONG and BINARY-DOUBLE, so a REDEFINES over one of them is reported HIGH", "COBOL016 (MEDIUM) flags platform-dependent REDEFINES. It fails a gate only when fail_on is MEDIUM or LOW; exclude_types COBOL_PLATFORM_DEPENDENT_LAYOUT keeps it out", "YAML_INDENTATION reports a file only when the indentation step changes, so normal nested YAML is no longer flagged", "check-test-contradictions exits 2 when no test file was checked or on an internal error; GitHub Action users on @v4 get 4.17.0, pin @v4.16.0 to keep the old behaviour" ] }, { "version": "4.16.0", "date": "2026-10-12", "type": "feat", "highlights": [ "A run that analyzes no files no longer passes --fail-on: it exits 1 with 'Gate failure: no files were analyzed'; --allow-no-files keeps exit 0 for runs that are empty on purpose", "Vendored and minified JavaScript (*.min.js, vendor/, static/**/libs/ ...) is skipped by default; the summary, JSON and SARIF say how many, and --include-vendored restores it", "The zero-files warning names how many files were skipped as vendored; GitHub Action users on @v4 get 4.16.0, pin @v4.15.1 to keep the old behaviour" ] }, { "version": "4.15.1", "date": "2026-10-11", "type": "fix", "highlights": [ "--exclude and the default exclusions match whole path components relative to the analysis root (a checkout under /tmp/build no longer skips every file)", "YAML files with several documents and Helm templates are analyzed instead of failing to parse", "EVAL_USAGE comes from the syntax tree, so comments, strings and method names like model.eval() no longer trigger it", "COBOL004 no longer flags intended REDEFINES idioms; GitHub Action users pinned to @v4.15.0 should move to @v4.15.1" ] }, { "version": "4.15.0", "date": "2026-10-10", "type": "feat", "highlights": [ "SARIF 2.1.0 output (hefesto analyze --output sarif) with stable hefestoFingerprint/v1 fingerprints for GitHub code scanning", "The GitHub Action is now a composite action with sarif / sarif_file / upload_sarif inputs", "COBOL: COPY ... REPLACING expansion from copybooks inside the scanned tree, plus faster scans of large programs" ] }, { "version": "4.14.1", "date": "2026-10-06", "type": "fix", "highlights": [ "Secret detection no longer skips production files whose path merely contains \"test\" or \"example\" (SEC-03)", "HTML report escapes every interpolated value (SEC-05)", "GitHub Action telemetry is really opt-in (SEC-06); min_severity INFO no longer crashes the Action (BUG-13)" ] }, { "version": "4.14.0", "date": "2026-10-06", "type": "feat", "highlights": [ "Opt-in --format-check: reports files Black would reformat (pip install \"hefesto-ai[format]\")", ".hefesto.yaml project config for hefesto analyze (--config PATH / --no-config)", "PyYAML is now a core dependency" ] }, { "version": "4.13.1", "date": "2026-05-08", "type": "fix", "highlights": [ "R3 (RELIABILITY_SESSION_LIFECYCLE) no longer flags self-managed connections closed by a sibling method (PR #35)" ] }, { "version": "4.13.0", "date": "2026-05-06", "type": "feat", "highlights": [ "Parser-failure visibility: stderr warning + report.meta.parser_failures when tree-sitter languages are skipped", "CI smoke test for the [multilang] extra on Python 3.10-3.13", "Tightened tree-sitter-language-pack pin (skips broken 1.6.3 wheel)" ] }, { "version": "4.9.3", "date": "2026-02-24", "type": "feat", "highlights": [ "MCP endpoint live (JSON-RPC 2.0)", "Registered in official MCP Registry", "Published on Smithery", "llms.txt expanded (10 languages, 30 intent queries)", "AI discoverability stack complete" ] }, { "version": "4.9.2", "date": "2026-02-23", "type": "feat", "highlights": [ "OSS api_hardening wiring merged", "CI passing on all Python versions", "Test isolation fix applied" ] }, { "version": "4.0.0", "date": "2026-01-15", "type": "major", "highlights": [ "Phase 0: basic validation", "Phase 1: ML semantic analysis", "Hefesto Analyzer: complexity, code smells, security", "117 tests passing", "PyPI published as hefesto-ai" ] } ], "latest": "4.20.4", "pypi": "https://pypi.org/project/hefesto-ai/", "github": "https://github.com/artvepa80/Agents-Hefesto" }